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C"| . Abstract 

O ,■ 

We consider a recently proposed generalisation of the abclian hidden subgroup prob- 
lem: the shifted subset problem. The problem is to determine a subset S of some abelian 
group, given access to quantum states of the form \S + x), for some unknown shift x. 
We give quantum algorithms to find Hamming spheres and other subsets of the boolean 
cube {0, 1}™. The algorithms have time complexity polynomial in n and give rise to 
exponential separations from classical computation. 

cn : 

> : 

^ ■ 1 Introduction 

m ■ 

It is widely believed that certain problems can be solved significantly more quickly using a 
quantum computer than is possible classically. The canonical example of such a speed-up 
is Shor's factoring algorithm [20] . In common with most known super-polynomial quantum 
speed-ups, the algorithm exploits a hidden structure in the input (in this case, hidden 
\ periodicity). 

Shor's algorithm has been generalised to give a polynomial-time quantum algorithm 
for the abelian hidden subgroup problem, which can be defined as follows [51 [15]. Given 
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an abelian group G, and a function / : G — > S (for some arbitrary set 5) promised to 
be constant on cosets of some subgroup H < G and distinct on each coset, find a set of 
generators for H. One of the major open challenges in the field of quantum algorithms is 
the solution of the further generalisation of this problem to non-abelian groups. (Among 
other things, this would give an efficient quantum algorithm for the graph isomorphism 
problem [31 [16].) However, there are some indications that the general non-abelian hidden 
subgroup problem might be hard for quantum computation as well [131 119] . 

With this in mind, it is natural to look for other hidden structures that can be exploited 
by a quantum computer, perhaps of a less group-theoretic nature. Notable examples of 
problems that are based on such structures are the generalised hidden shift problem of 
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Childs and van Dam [7j and the hidden polynomial problem of Childs, Schulman and 
Vazirani [8], a modification of which was also studied by Decker, Draisma and Wocjan 
[9l [10]. This paper is concerned with another problem of this kind, which was also recently 
defined by Childs et al. in [8]: the shifted subset problem. 

This problem can be informally stated as follows. Given a machine producing quantum 
states which are equal superpositions of the elements in some subset S of an abelian group 
G, with each element shifted by an equal but unknown offset x, determine S. Given the 
promise that S is picked from a certain family of subsets, the hope is to find an efficient 
quantum algorithm for this problem. If S were promised to be a subgroup of G, this could 
be achieved using the quantum algorithm for the abelian hidden subgroup problem. 

Of course, this formulation is intrinsically quantum, and we would like the problem to 
make sense classically too. The black-box approach taken for the abelian hidden subgroup 
problem will not be suitable, as shifted subsets may intersect. However, it turns out that 
one can define (see Section [5]) an oracular problem corresponding to any shifted subset 
problem. This problem can be solved efficiently by a quantum algorithm, assuming that its 
related shifted subset problem can be, but requires exponential time to be solved classically. 

The work of Childs et al. focused on the additive group of F™, for ¥ q a finite field with 
q a prime power, and n constant. In this work, we consider quantum algorithms to find 
hidden subsets of the boolean cube {0, l} n . This is a natural generalisation of the problem 
used by Simon [21 j to show the first exponential separation between quantum and classical 
bounded-error computation, which is also a special case of the abelian hidden subgroup 
problem. (In the case of Simon's problem, the shifted subsets are lines.) Explicitly, the 
general formulation of the problem is as follows. 

Shifted Subset Problem. An unknown subset S C {0, l} n is picked from a 
known family of subsets T. Given an oracle that produces a supply of states of 
the form 

V\ b \ ses 

for some unknown and varying shift x, determine S. 



We generally look for quantum algorithms that run in time polynomial in n. (Note that 
this is a different regime to that considered by Childs et al. in [8], where the dimension n 
was considered to be constant, and q grew; in that paper, quantum algorithms were sought 
that ran in time polylog(g).) One particular class of subsets considered by Childs et al. 
were hidden spheres in F™ (a point x = (xi, x n ) is said to be on the sphere in F™ with 
radius r E ¥ q centred at the origin if ^ x\ = r). Here, we consider the natural counterpart 
for the cube: spheres with respect to the Hamming weight. The formal definition of this 
problem is given below. 

The main contribution of this paper is an explicit polynomial-time quantum algorithm 
for the shifted sphere problem in any dimension n. This is in contrast to the algorithm of 
Childs et al., which only determined a single bit of r, and only for n odd. (On the other 
hand, it was shown in [8] that the quantum query complexity of determining r completely 
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Shifted Sphere Problem. Let S r be the subset {x £ {0, l} n ||x| = r}, where 
\x\ is the Hamming weight of x and < r < n/2. Given an oracle that produces 
a supply of states of the form 




for some unknown and varying shift x, determine r. 



is polynomial when n is odd, and evidence was presented for this being true for even n as 
well.) Our algorithm's running time is unpalatably high (0(n 4 ) for n odd and 0(n 6 ) for 
n even); however, in the case where n is even, we give a linear-time quantum algorithm to 
determine whether r is even or odd. We also give efficient and quite straightforward quantum 
algorithms for three other classes of shifted subset problems: sets of greatly different sizes, 
juntas and parity functions. 

The quantum component of all the algorithms in this paper is extremely simple, con- 
sisting only of the Fourier sampling primitive of Bernstein and Vazirani [4]. However, we do 
not see this as a disadvantage, but rather as an example of how classical postprocessing can 
unlock the power of a simple quantum circuit. This work also hints that there may exist 
other, more subtle problems for which this primitive may be of use. We note that Bshouty 
and Jackson [6], and also Atici and Servedio p], have proposed quantum algorithms that 
use only the Fourier sampling primitive for tasks in computational learning theory. 

The paper is organised as follows. Section [2] describes the generic quantum part of 
algorithms for shifted subset problems. Section [3] gives a quantum algorithm for the shifted 
sphere problem, and Section 0] describes other shifted subset problems for which we have 
efficient quantum algorithms. Section [5] gives an oracular problem which can be used to 
show an exponential quantum-classical separation for shifted subset problems. Section [6] 
has some brief concluding remarks. 

We now proceed to give the general quantum algorithm for shifted subset problems. 

2 The quantum algorithm 

Assume that we wish to determine a secret subset S C {0, l} n using an oracle which provides 
us with a supply of states of the form 



where the shift x is unknown. Call these shifted subset states. Our goal is to use these 
states to determine S. The quantum component of the algorithm for doing so is in fact 
independent of S. In order to remove the unknown and unwanted shift x, the first step is 
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to perform the Fourier transform over by applying Hadamard gates to each qubit, 



H® n \s + x) = 1 y y* (-!)*•(»+») u\= 1 y y^(_r 

/I Clon Z— / Z^ v y 1 ' /I elon y ' 
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wz \z). 



Next, we measure this state, giving rise to the following probability distribution, which will 
be called tts- 



We can now attempt to use samples from this distribution (Fourier samples [3]), which are 
n-bit strings, to infer S. In Appendix B, we give a general upper bound on the number 
of Fourier samples required to identify shifted subsets (without considering the complexity 
of postprocessing the results). In order to understand this distribution, it will be useful 
to borrow some basic ideas from Fourier analysis; for notation, see For a function 

/ : {0, l} n — > R, we have the following notation for the Fourier transform of / over ZJ? : 



1 2 n 
v ye{o,i} n 

This allows us to express tts in a compact way in terms of the Fourier transform of the 
characteristic function I5, 

— 2 
Is 

* 8= w 

3 Shifted spheres 

We will now consider a particular family of subsets: Hamming spheres. That is, the family 
of subsets {S r }, where x £ S r if and only if \x\ = r. r is the radius of the sphere. Our goal 
will be to find the radius of such a sphere, given access to states of the form 

\S r + x) = p — \y + x) 

ye{0,l}",|y|=r 



for some arbitrary shift x. (Note that we must insist that r < n/2, as states of the form 
\S r + x) are indistinguishable from those of the form \S n - r + x').) We give a bounded-error 
quantum algorithm to find r in polynomial time. 

3.1 Preliminaries 

In a mild abuse of notation, define 7r r = irs r - Then 



Tr r (x) = 



)2 n 



v2/G{0,l}",|j/|=r 
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where x is an n-bit string. These sums have been much studied in the coding theory litera- 
ture and are known as Krawtchouk polynomials \17\ I18j. The r'th Krawtchouk polynomial 
is defined as 

K?(x)= £ (-l)^ = E(-l) i ( l ^ l )( n r "Jf). 

y£{0A}",\y\=r i=o \ / \ / 

We use the notation K r (x) when n is understood to be fixed. Thus we have 7r r (x) = 
K r (\x\) 2 /((™)2 n ). As this distribution depends only on \x\, we will only consider the Ham- 
ming weight of the outcome and redefine x = \x\, < x < n, giving 




We will sample from this distribution to determine r. 



3.2 A polynomial-time quantum algorithm 

We now give a polynomial-time bounded-error quantum algorithm that determines the 
radius r from samples of tt t .. The algorithm runs in time 0(n 6 ) for n even, and 0(n 4 ) for 
n odd. 

Our goal will be to estimate r by estimating the probabilities of certain measurement 
outcomes which occur often. In particular, those with the Hamming weights n/2, n/2 — 1 
and n/2 + 1 for n even, and (n — l)/2 and (n + l)/2 for n odd. We start by determin- 
ing the probabilities of these outcomes. Note that the probability of any given outcome 
can be calculated efficiently, as there is an 0(n log 2 n) algorithm to evaluate Krawtchouk 
polynomials [12]. 



Lemma 1. If n is even, then the probability of obtaining an outcome with weight n/2 is 

, r(n /2) = {f« 2 )((^)/ 2 ) (J«™> , 
[0 (r odd) 



and the probability of obtaining an outcome with weight n/2 — 1 or n/2 + 1 is 
ir r (n/2 - 1) + 7r r (n/2 + 1) = 



2«- 1 n(n+2) (r/2) {(n-r)/%) ( r even ) 

2"-5 n ( n+2 ) ((r-l)/2) ((n-r-l)/2) ( T ° dd )' 



If n is odd, then the probability of obtaining an outcome with weight (n— l)/2 or (n+ l)/2 
is 

M(n ~ D/2) + M(n + D/2) = ( ^l^fk) , f "li 

\ 2"- 2 (n+l) \{r-l)/2) \{n~r)/2> < r 0aa '- 

Proof. Deferred to Appendix A. □ 
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In the case of n even, this immediately suggests the following algorithm to determine 
whether r is even or odd. Sample a number of times from 7r r , output that r is even if any 
outcomes with weight n/2 are obtained, and output "odd" otherwise. Using the inequality 
that 

2 2n (2n\ 2 2n 

> ( > -=, (2) 



\fim \n J y/2irn 
which is valid for n > 0, it is clear that for r = 0, 7r r (n/2) = £1(1/ y/n). For even r > 0, 

vr r (n/2) > - / = n(l/n), (3) 
vr ^Jr(n — r) 

which implies that we need only 0(n) samples to determine the last bit of r with constant 
probability of success. 

We now describe a slightly more complex algorithm for calculating r completely, again 
when n is even. Take k samples from ir r , for some k to be determined. Count the number 
of times t± that an outcome with Hamming weight n/2 occurs, and the number of times t% 
that an outcome with Hamming weight n/2 — lorn/2+1 occurs. 

If t\ > 0, then r is even. In this case, consider the measurement process as a biased coin 
that produces heads with probability ir r (n/2) and tails with probability 1 — % r (n/2). By a 
standard Chernoff bound argument, to estimate this probability within additive error e with 
constant probability of success, it is sufficient to take the average of the number of heads 
obtained in k = 0(1/ e 2 ) trials. To determine the number of trials required, we therefore 
need to lower bound the minimum, over all even r ^ s with r,s < n/2, of \n r (n/2)—n s (n/2)\. 
This can be carried out using Lemma [H as follows. 

Consider the difference 7r r (n/2) — 7i>+2(n/2), for < r < n/2 — 2. By expanding 
ir r+ 2(n/2) in terms of ir r (n/2), we have 

/ /o\ i 1 ( -x (n-r)(r + l) \(r\( n-r 

7r r (n/2) - ir r+2 (n/2) = — 1 



2™ V (n-r -l)(r + 2) J \r/2J \(n- r)/2 
1 / n — 2(r + 1) \ / r \ / n — r 



2 n y( Jl _ r _ !)( r + 2) J \r/2j \(n - r)/2 y 

The product of binomial coefficients can be lower bounded using eqn. and as r < n/2— 2, 
it is easy to see that the remaining fraction is positive and £l(l/n 2 ). This implies that 
\n r (n/2) — ir s (n/2)\ = Q(l/n 3 ) for all even r ^ s with r, s < n/2. This in turn implies 
that we can estimate 7r r (n/2) - and hence r - in the case where r is even after a somewhat 
unappetising k = 0(n 6 ) trials. 

On the other hand, consider the case where t\ = after Q(n) trials. Hence we can 
assume that r is odd, and estimate p(r) = 7r r (n/2 — 1) + i: r (n/2 + 1) from using the 
same technique as in the previous paragraph. We calculate p(r + 2) — p(r) by expanding 
binomial coefficients: 

1 r ( (r + 2)(n — r — 1) , .\ / r—1 \f n — r — 1 

p(r + 2)-p(r) = =— ; v A '--(n-r) L w L 

Fy 1 Fy ' 2"- 5 n(n + 2) V r+1 V ') \(r - 1)/2J \(n - r - l)/2 

1 r(n — 2(r + 1))/ r — 1 \ f n — r—1 



2™" 5 n(n + 2)(r + 1) \(r - 1)/2J \(n - r - l)/2 
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Using the approximation ([2]) gives the result that, for all r,s < n/2 with r ^ s, \p(r)—p(s)\ = 
f2(n -3 ), implying that we can calculate the hidden radius in this case with a constant 
probability of success after 0(n 6 ) trials as well. 

We finally turn to the case of n odd. Here, we consider the measurement outcomes 
with weight (n — l)/2 and (n + l)/2. Again, we treat the measurement process as a biased 
coin, and attempt to estimate p'(r) = 7r r ((n — l)/2) + ir r ((n + l)/2). First, note that the 
probability p'{r) for r even is equal to p'{n — r), where n — r is now odd. As before, we can 
calculate p'{r + 2) — p'(r) for r odd by expanding binomial coefficients: 

1 r ( (r + 2)(n — r) \ / r — 1 \ / n — r\ 

2 n-2 n + i \( r + l)( n - r - 1) ~ ) \(r -\)/2)\{n-r)/2) 

1 r / r — 1 \ / n — r \ 

2 n-2 ( r + !) ( n _ r _ x) \ v ( r _ i)/2 y \(n - r)/2J ' 

The product of binomial coefficients divided by 2 n ~ 2 can be estimated as Q(l/n), implying 
p'(r+2)— p'(r) = f2(n~ 2 ). Using the Chernoff bound argument again, in order to infer r with 
a constant probability of error by estimating the probability ir r ((n — l)/2) + 7r r ((n + l)/2), 
0(n 4 ) trials are sufficient. 



p'(r + 2) — p'{r) = 



3.3 Shifted Hamming balls 

We make a brief remark regarding the related structure of balls with respect to the Hamming 
weight, i.e. the family of subsets {B r }, where x £ B r if and only if |x| < r. r is the radius 
of the ball. The shifted subset problem for Hamming balls is to find the radius of such a 
ball, given access to states of the form 

\B r + x) = ^2 \y + x ) 

yELo (k) s/e{o,i}",|y|<r- 

for some arbitrary shift x. In this case, it is not necessary to insist that r < n/2 for the 
problem to be well-defined. 

As a ball is simply the union of disjoint spheres, its Fourier transform is a sum of 
Krawtchouk polynomials. This can be simplified using a convenient expression for the sum 
of Krawtchouk polynomials [18j , 

r 
s=0 

This implies that the probability distribution 7r r (x) that gives the probability of obtaining 
an outcome with weight x when the hidden ball has radius r is given by 

Similar results can thus be obtained for finding shifted balls as in the case of shifted spheres. 



7 



4 Other shifted subsets 

In this section, we note three further classes of shifted subsets which can be distinguished 
efficiently by a quantum algorithm. 

4.1 Subsets that differ greatly in size 

For a particular subset 5, consider the probability of obtaining the zero string from a 
Fourier sample, TTs(O n ). It can be verified directly from eqn. (pQ) that this is equal to 
\S\/2 n . Consider an unknown subset S picked from a family of subsets {Si} which all 
have significantly different sizes, i.e. ||Sj| — \Sj\\ = 2 n /poly(n) for i ^ j. Then |5| can be 
estimated, and thus S determined, from a polynomial number of Fourier samples simply by 
counting the number of zero weight outcomes received, and using this to estimate ns(O n ). 

4.2 Juntas 

Consider a set of non-constant boolean functions ••-,/&} on n variables that each 
depend on a different, disjoint subset Tk C [n] of variables, where each subset is of constant 
size. Such functions are known as juntas. Define a family of subsets T = {Sk} by letting fk 
be the characteristic function of Sk- As fk is not constant, \Sk\ < 2™~l Tfc l(2l Tfc — 1) = c2 n 
for some constant c < 1. 

It is easy to see that the Fourier transform of the shifted subset state corresponding to 
Sk has no support on those bit-strings which have l's in positions outside of Tk- (This is just 
saying that the Fourier transform of a function that depends on a certain set of variables 
depends only on those same variables.) This implies that, as the sets {Tk} are all disjoint, 
obtaining any measurement outcome other than the zero string is sufficient to identify Tk, 
and thus Sk- However, as noted in Section B~Tj 7T5 fc (0 n ) = \Sk\/2 n = c < 1, so a constant 
number of repetitions suffice to obtain such a non-zero measurement outcome. 

4.3 Parity functions 

Consider a subset S C {0, l} n consisting of those bit-strings whose parity on some non- 
empty subset T of the n bits is 1. That is, the characteristic function ls(x) = ©jg^Xj. 
Note that the set S is not a subgroup of {0, l} n , although its complement is a subgroup. 

Let t be the bit-string corresponding to the characteristic function It (that is, t\ = 
1 44> i £ T). Then it is easy to see that the Fourier transform I5 is supported on only two 
positions: 
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which is zero unless x is equal to t or the zero string; moreover, in both these cases |lg(x)| 
is equal. Therefore, sampling from the distribution its will give t with probability 1/2, so 
only a constant number of samples is necessary to determine t, and thus S, with any desired 
constant probability. 

We can generalise this family of subsets as follows, again in terms of characteristic 
functions. Let T be a subset of the first k bits, for some arbitrary k. Consider a family 
of 2 k subsets T for which, for each S E J 7 , the characteristic function ls{x) = ®i e x x i © 
fs(xk+i, ■ ■ ■ , x n ) for a distinct T, where /g is an arbitrary boolean function of the remaining 
n — k bits. Thus I5 is the sum of the bits in T, added to some arbitrary function of the 
remaining bits. Again, let t be the A:-bit string corresponding to It- Now the Fourier 
transform of lg will have support only on the zero bit-string and those bit-strings whose 
first k bits are equal to t: 

r s (x) = -L £ (-l) xy (l - (-ifym+fs(yk+i,-,yn)y 2 
\»e{o,i}» 



1 



^+2 



v 2/e{o,i} n y e{o,i} n - k ze{o,i} k 



where the notation a?rw represents the first bits of x and x_[ n _^ represents the last n — k 
bits of x. It is easy to see that this is zero unless x = or = t. So, once more, a 
constant number of samples suffice to determine S. 



5 Black-box formulation of shifted subset problems 

In order to show separations between quantum and classical computation for shifted subset 
problems, we need to introduce an oracular problem based on shifted subset problems which 
is hard for classical computers to solve. The standard approach used for hidden subgroup 
problems is to define an oracle function which is constant on subset elements with a given 
shift, and distinct on each shift [21]. This is not suitable for the generalised problem 
considered in this paper, as shifted subsets may intersect. 

We therefore take a more general approach, which is very similar to that in Appendix 
A of [8], but is modified to work for subsets of arbitrary size (the approach in [8] required 
subset sizes to be close). The black-box problem we define would make sense for arbitrary 
underlying abelian groups, but for concreteness we consider only {0, l} n . 

Consider a subset 5 C {0, l} n . Order the elements of S arbitrarily and let S[x] be the 
x'th element of S. We will define the following three functions on the set {0, l} 2n (this 
increase of input size from n to 2n bits is needed to show classical hardness). 

• A "colouring" operator c : {0, l} 2n — ► [2 2n ], which maps each point on the 2n- 
dimensional cube to one of [2 2n /|S|] "colours", i.e. integers between 1 and 2 2n . We 
restrict c to send exactly \S\ points to each colour, assuming that IS") divides 2 2n for 
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simplicity (if it does not, then send \S\ points to all colours but one, and give the rest 
of the points the remaining colour). 

• A "shifting" operator s : {0, l} 2n x [2 2n ] — > {0, 1}™. For each cq, and for all x such that 
c(x) = Co, s(x, Co) = S[tt co (x)] + d(co), where 7r co is an arbitrary bijection between the 
set of points with colour Co and S, and a is an arbitrary mapping between the set of 
colours used by c and {0, 1}™. That is, s maps x to a point in S, translated by an 
unknown shift <r(co). For x such that f(x) / Co, s(x, cq) returns an arbitrary point in 
{0,1}". 

• An "uncolouring" operator cr 1 : [2 2n ] x {0, 1}™ — > {0, l} 2n which performs the oper- 
ation (co, s(x, cq)) x for a valid pair (co, s(x, cq)), and maps all other arguments to 
arbitrary 2n-bit strings. 

An instance of the oracular problem is given by the 4-tuple (S, c, s, c _1 ). Our task is 
to determine S, given access to these oracles. Given a complete set of points of a given 
colour, a classical algorithm can find S by simply querying s on those points. In fact, it 
may not even be necessary to query s at all: determining the number of colours used by c 
is sufficient to determine |5|, for example. 

However, we now sketch a proof that, in the worst case, any classical algorithm must 
make many queries to c to get any information about S. Let c be picked uniformly at 
random from the set of valid colouring operators, and consider a deterministic algorithm 
that makes a sequence of queries to c. As \S\ < 2", at least 2 n colours are used. Because 
c is random, by a standard birthday argument the algorithm must make f2(2 n / 2 ) queries 
before it finds two points x, y that have the same colour. But querying s on two points 
that have different colours does not give any information about S. 

On the other hand, consider the following quantum procedure. Query c on a uniform 
superposition of all points x G {0, l} 2n . Measure the output register, thus giving a super- 
position of all points with a particular colour q> Query s, then uncompute c. This will 
leave a superposition of items in S, offset by an unknown shift (that depends on co). In 
other words, we perform the following operations (ignoring normalisation factors). 

^2 \x) ^ \ x )\ c (x)) 

x£{0,l} 2n x£{0,l} 2n 

~ E WMlSMx)} + a(c )) 

x,c(x)=co 

^ £ |0)|c )|^ co (x)]+a(c )). 

x,c(x)=cq 

Ignoring the first two registers, this is a shifted subset state \S + <r(co)). Thus a polynomial- 
time quantum algorithm that obtains any information about the shifted subset S implies 
an exponential separation between quantum and classical computation. 
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6 Conclusion 

We have given polynomial-time quantum algorithms for finding shifted subset structures 
on the boolean cube, and in particular for determining the radius of a shifted sphere. By 
defining a suitable oracle problem, these lead to an exponential separation between quantum 
and classical computation. 

There are a couple of obvious possible extensions of this work. Firstly, finding other 
interesting families of subsets of the cube for which we can solve the shifted subset problem, 
or indeed more efficient algorithms for the shifted sphere problem. Ideas from the field 
of analysis of boolean functions might be helpful here. Secondly, and more challengingly, 
finding a practical and non-oracular problem for which the techniques of this paper are of 
use remains an open problem. 

The following two additional open questions were suggested by Andrew Childs. Firstly, 
could the results of this paper be generalised to the underlying group ZjJ, where k is con- 
stant? And secondly, another problem considered in [8] was the hidden flat of centres 
problem in F™ (for q large and n constant). In this case, spheres are of constant radius, but 
their centres are constrained to lie in an affine subspace. The problem is to determine this 
subspace. Could an analogue of this problem be solved on the boolean cube? 
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Appendices 

A Proof of Lemma [I] 

For the reader's convenience, we repeat the statement of Lemma [TJ 

Lemma. If n is even, then the probability of obtaining an outcome with weight n/2 is 




(r even) 
(r odd) 



and the probability of obtaining an outcome with weight n/2 — 1 or n/2 + 1 is 




(r even) 
(r odd). 
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If n is odd, then the probability of obtaining an outcome with weight (n — l)/2 or (n + l)/2 
is 

( n—r { r \ / n—r—1 \ / ) 

M(n ~ D/2) + vr r ((n + l)/2) = ^ 1^7 ^ 1 £ !T 

[ 2 n - a (n+l) l(r-l)/2^ V(n-r)/2j < r 0a£ V' 

Proof. The proof uses several recurrences and other properties satisfied by the Krawtchouk 
polynomials [T7J. Firstly, for n even, the case n r (n/2) can be calculated explicitly using the 
generating function representation of the Krawtchouk polynomials [T7] . 

K r {x)z r = (1 - z) x (l + z) n ~ x , 

r=0 

implying 

„2fc 



jr K r (n/2)z r = (1 - z) n l\l + z) n / 2 = (1 - z 2 )™/ 2 = ]T(-l) fc h 2 ) 

r=0 k ^ k ' 



Z 



Therefore, for odd r, K r (n/2) and hence ir r (n/2) are zero. For even r, we have K r (n/2) 
(-l) r / 2 C$), implying 

, /rA _ (n/2) (r/2) _ 1 / rW n-r 
Mn/) " C)2» -2»W2A(~-r)/2 y 
where the second equality follows by expanding the binomial coefficients and simplifying. 
We will use the following recurrence to calculate K r {n/2 — 1) for r even |17j : 

xK r (x - 1) = (n - 2r)K r (x) - (n - x)K r (x + 1). 

As K r {x) = (— l) r K r (n — x), this implies that 

K r (n/2 - 1) = (1- 2r/n)K r (n/2) = (1 - 2r/n)(-l) r/2 [ ^ ) (r even). 



r/2 

To find K r {n/2 — 1) for r odd, we use another recurrence, 

K r (x - 1) = i^r-iO) + K r -i(x - 1) + #r(x), 

from which, by substituting in the previously obtained value of K r -\[n/2 — 1), using the 
fact that K r (n/2) = and simplifying, we obtain 

\{r-\)/i( n/2 -I 



K r (n/2 - 1) = 2(-l)™< ^ '_ j (r odd). 

These expressions give 7r r (n/2 — 1) = 7r r (n/2+l) for n even, following another expansion and 
simplification of binomial coefficients. In the case of odd n, we use yet another recurrence 
satisfied by the Krawtchouk polynomials, 

K?{x) = K?~\x) + K^zl(x). 

One can easily verify that this gives the claimed expressions for 7r r ((n — l)/2) = 7r r ((n + 
l)/2). □ 
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B Upper bounds on query complexity 



We would like to show that, for some particular family T = {Si} of subsets, a subset S 
picked from T can be determined using only a small number of "Fourier samples" from the 
probability distribution 7rg. It turns out that it is sufficient to show that the distributions 
{it are far apart in a pairwise sense [21 HI] . 

We make the following definitions. The p-norm of a vector / is = {^2 X \fx\ p ) l ^ P , 
and the (Schatten) p-norm of a matrix p is ||p|| p = ||<t(/o)|| p , where a(p) is the vector of 
singular values of p. The fidelity of two quantum states pi, pj is F(pi,pj) = \\-^Piy/pj\\i- 
Then the following holds [21 [TJ] . 

Theorem 2. Let S = {pi} be a set of N quantum states with F(pi,pj) < F for all i ^ 
j. Then, given n copies of an unknown state p? from S, there is a measurement which 
determines the identity of p-? with probability 1 — e if 

2(logJV/e) 



n > 



logl/F 



The following corollary is essentially immediate from a well-known inequality relating 
fidelity and trace distance, i.e. that F(pi,pj) < 1 — \\\pi — Pj\\\- 

Corollary 3. Let S = {pi} be a set of N quantum states with \\pi — pj\\i > T for all i ^ j. 

Then, in order to determine which state an unknown state p? from S is with constant 
probability of error, it is sufficient to have n = O ((log./V)/T 2 ) copies of /??. 

Note that although this result holds for general quantum states, here it is applied only 
to classical probability distributions. 

With Corollary [3] in mind, we give an inequality that lower bounds the trace distance 
(aka l\ distance) between two such probability distributions in terms of the characteristic 
functions of their sets. The inequality is based on the simplest case of the Hausdorff- Young 
inequality, which may be written down as ||/||oo < ||/|| l/V^- To state the inequality, we 
define the convolution operator * as 

tf*9){x) = ^= f(y)g(x + y). 



/on £ — ' 

j/G{0,1}^ 



It is a basic fact in Fourier analysis that the Fourier transform changes convolution into 
multiplication: / * g = fg [TT] . 

Lemma 4. Let its, t^t be the probability distributions corresponding to the sets S, T. Then 

I5 * 1<j It * It 



tttIIi > \/2™ 



\S\ 



Proof. By the Hausdorff- Young inequality, we have 
lg * I5 It * It 



\S\ 



< 



I5 * I5 It * It 




15 It 


\S\ \T\ 


1 


\S\ \T\ 



\TVS - 7TT 1- 



□ 
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This inequality implies that the number of Fourier samples required to solve a shifted 
subset problem can be upper-bounded without needing to work directly with the Fourier 
transform of a set's characteristic function (which may be complicated). Unfortunately, 
when applied to the shifted sphere problem, the upper bound produced is no better than 
the time complexity of the algorithm of Section [3l 
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